1
# Gemfile.lock
- nokogiri (1.13.1)
-   mini_portile2 (~> 2.7.0)
+ nokogiri (1.13.9-x86_64-linux)

...

PLATFORMS
-  ruby
+  x86_64-linux

Hello! Dependabot is recommending a gem bump Nokogiri 1.13.1 -> 1.13.9 with the above diff.

However I cannot figure out why dependabot is recommending the bump to x86_64 as opposed only 1.13.9, which appears to be an appropriate tag. https://rubygems.org/gems/nokogiri/versions/1.13.9

Additionally, I don't understand why PLATFORMS would require the above change. Shouldn't the platform be specified on the specific nokogiri line if necessary at all? I am relatively new to the rails repository in question, what can I look for to help my understanding as to why dependabot is recommending this particular version bump? I don't see anything in the https://github.com/sparklemotion/nokogiri/releases which looks relevant so I suspect the repository configuration is to blame.

Before I posted I looked at

Unfortunately, I did not draw any conclusions from reading these similar issues. Any insight would be appreciated.

i0x539
  • 4,763
  • 2
  • 20
  • 28
  • 1
    Running `bundle update nokogiri` produces the same output? – Peter Toth Nov 21 '22 at 00:30
  • @Peter. obviously i should have posted that too, sorry. No, the output looks more like what I would expect. Just updating mini_portile2 and nokogiri versions. No change to platforms. – i0x539 Nov 22 '22 at 20:09
  • 1
    Well, then maybe Dependabot got too creative. How about just using `bundle update nokogiri` and trust bundler to keep the lock file in a good shape? This is what I do usually and I have never had any problem. – Peter Toth Nov 24 '22 at 01:41
  • yes, this is what I ended up doing. I'm still curious what dependabot is thinking though. Thank you for the comment regardless. – i0x539 Nov 27 '22 at 20:08

1 Answers1

1

nokogiri is published in multiple versions with prebuilt native extension for corresponding platforms, this allows installation on machines (or containers etc) where compilation is not desirable or not possible.

You can add used platforms to your lockfile via

# usually production is x86 linux:
bundle lock --add-platform x86_64-linux

# for M1/M2 macs:
bundle lock --add-platform arm64-darwin
Vasfed
  • 18,013
  • 10
  • 47
  • 53
  • 1
    Thank you for your reply! Not exactly what I wanted but because you taught me something and this is the only official answer I'm awarding you the bounty. Cheers. – i0x539 Nov 27 '22 at 20:09